dionysos-0.11.2 is not a library.
dionysos
Scanner for various IoCs
Installation
sudo apt install libyara-dev
cargo install dionysos
Features
Feature | Details |
---|---|
Scanners | filenames (by regular expressions), similar filenames (Levenshtein), yara, hashes |
Output formats | human-readable text (txt), comma-separated values (csv, conforming to RFC4180), JavaScript Object Notation (json), can be selected with --format <txt|csv|json> |
Scan of compressed files | yara-scan of gz and bz2 compressed files is supported; see -C switch. Be aware that files are decompressed into a decompression buffer, and that every thread gets its own decompression buffer. You should make sure that you have sufficient memory. If you need larger buffers, you can limit the number of threads using --threads |
Special features | yara-scan in Windows evtx files and Windows registry hives using --evtx and --reg |
Usage
dionysos 0.11.1
Jan Starke <Jan.Starke@t-systems.com>
Scanner for various IoCs
USAGE:
dionysos [OPTIONS]
OPTIONS:
-C, --scan-compressed
allow yara to scan compressed files. Currently, xz, bz2 and gz are supported
--decompression-buffer <DECOMPRESSION_BUFFER_SIZE>
maximum size (in MiB) of decompression buffer (per thread), which is used to scan
compressed files [default: 128]
--evtx
also do YARA scan in Windows EVTX records (exported as JSON)
-f, --format <OUTPUT_FORMAT>
output format [default: txt] [possible values: csv, txt]
-F, --filename <FILENAMES>
regular expression to match against the basename of files. This parameter can be
specified multiple times
-h, --help
Print help information
-H, --file-hash <FILE_HASH>
Hash of file to match against. Use any of MD5, SHA1 or SHA256
-L, --log-file <LOG_FILE>
path of the file to write logs to. Logs will always be appended
--omit-levenshtein
do not run the Levenshtein scanner
-p, --threads <THREADS>
use the specified NUMBER of threads [default: 16]
-P, --path <PATH>
path which must be scanned
--progress
display a progress bar (requires counting the number of files to be scanned before a
progress bar can be displayed)
-q, --quiet
Less output per occurrence
--reg
also do YARA scan in Windows registry hive files
-s, --print-strings
print matching strings (only used by yara currently)
-v, --verbose
More output per occurrence
-V, --version
Print version information
-Y, --yara <YARA>
use yara scanner with the specified ruleset. This can be a single file, a zip file or a
directory containing lots of yara files. Yara files must end with 'yar' or 'yara', and
zip files must end with 'zip'
--yara-timeout <YARA_TIMEOUT>
timeout for the yara scanner, in seconds [default: 240]
Developer guide
How to add scanners
1. Implement a special result type for the scanner
For example, say we want to scan for files whose name match a regular expression. Our finding type could look like this:
Every finding type needs to implement Display
and ScannerFinding
:
2. Implementation of the scanner
Take, for example, the FilenameScanner
, which tries to do a simple filename match:
3. Add your scanner to the scanner chain
Which is currently hard-coded in Dionysos::run()
(in src/dionysos.rs)